Dumb question: how do I know if an open source project is trustworthy?
magic_lobster_party @ magic_lobster_party @kbin.run Posts 1Comments 624Joined 1 yr. ago
magic_lobster_party @ magic_lobster_party @kbin.run
Posts
1
Comments
624
Joined
1 yr. ago
There has been instances of popular and well meaning projects become hijacked by hostile actors. A recent notable example is xz, but there’s also event-stream npm package a few years ago that got infected with Bitcoin stealing code.
Just because a protect looks good now doesn’t mean it won’t turn bad in the future.
And not only would you need to audit the project. You also need to audit all of its dependencies as well. The xz vulnerability made it in to SSH. Who would think about looking into xz for vulnerabilities?
The benefit of installing back doors can be enormous.